Kim Maida

Kim Maida is Head of Developer Relations and Founding GTM Engineer at Keycard, where she focuses on a central security challenge for autonomous software: giving AI agents enough access to act without handing them unrestricted control over accounts, infrastructure, and data. Her work combines identity and access management, software engineering, and developer-relations leadership.

Maida began in animal behavior and neurobiology, taught herself programming, and built freelance web applications before moving into software engineering and engineering management. At Auth0, she advanced from technical content engineering into content, community, and developer-relations leadership. She subsequently led developer relations at Gatsby, held a vice-presidential role at Ionic, and worked in leadership positions at Okta, Cloudinary, and FusionAuth. Her account of progressing from developer advocate to executive connects that trajectory to building clearer career paths and strategic authority for developer-relations teams.

A Google Developer Expert in identity, Maida has built practical security projects including auth-architecture, which explores browser-based OAuth 2.0 and OpenID Connect patterns, and rota-slackbot, an open-source tool for managing team rotations. At Keycard, she applies her authentication background to nonhuman identity, delegated access, and agent governance.

• Authorization before credentials exist. Maida uses OAuth 2.0 token exchange under RFC 8693 to evaluate the user, the agent, delegated permissions, and organizational policy before a Security Token Service issues access. When policy forbids an action, the dangerous credential is never created.

• Short-lived, task-scoped agent access. Instead of broadly privileged API keys, she advocates ephemeral, audience-restricted credentials for individual tool calls. Her incident-response demonstration distinguishes routine certificate renewal from deleting a production database, restarting infrastructure, or increasing cloud spending—operations requiring materially different permissions.

• Human approval is not authorization. An operator cannot grant an agent permissions they do not possess. Approval prompts supplement enforceable policy and delegated identity; they do not override either or excuse consent fatigue.

• Keystone DevRel Metrics framework. Her approach to measuring developer relations ties reach, awareness, engagement, and qualified developer interest to concrete business measures. Her OAuth security guidance similarly translates standards into implementation decisions, including PKCE, avoiding implicit grants, and preventing token replay.